rekor-tiles: Update conditional for setting volume keys (#1104) #743
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Charts | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - "charts/**" | |
| workflow_dispatch: | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| packages: write | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Configure Git | |
| run: | | |
| git config user.name "$GITHUB_ACTOR" | |
| git config user.email "[email protected]" | |
| - name: Set up Helm | |
| uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1 | |
| with: | |
| version: 'v3.19.2' # pinned due to v4 incompatibility | |
| - name: Add dependency chart repos | |
| run: | | |
| helm repo add sigstore https://sigstore.github.io/helm-charts | |
| - name: Install sigstore Helm plugin | |
| run: | | |
| helm plugin install https://github.com/sigstore/helm-sigstore | |
| - name: Install GPG Keys | |
| run: | | |
| cat <(echo -e "${{ secrets.GPG_PRIVATE_KEY }}") | gpg --import --batch | |
| gpg --export > /home/runner/.gnupg/pubring.gpg | |
| gpg --export-secret-keys > /home/runner/.gnupg/secring.gpg | |
| - name: Run chart-releaser | |
| uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0 | |
| env: | |
| CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}" | |
| CR_SIGN: "true" | |
| CR_KEY: "${{ secrets.GPG_KEY_NAME }}" | |
| CR_KEYRING: "/home/runner/.gnupg/secring.gpg" | |
| - name: Upload Helm Charts to Rekor | |
| run: | | |
| for chart in `find .cr-release-packages -name '*.tgz' -print`; do | |
| helm sigstore upload --keyring=/home/runner/.gnupg/secring.gpg ${chart} | |
| done | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 | |
| - name: Publish and Sign OCI Charts | |
| run: | | |
| for chart in `find .cr-release-packages -name '*.tgz' -print`; do | |
| helm push ${chart} oci://ghcr.io/${GITHUB_REPOSITORY} |& tee helm-push-output.log | |
| file_name=${chart##*/} | |
| chart_name=${file_name%-*} | |
| digest=$(awk -F "[, ]+" '/Digest/{print $NF}' < helm-push-output.log) | |
| cosign sign "ghcr.io/${GITHUB_REPOSITORY}/${chart_name}@${digest}" | |
| done | |
| env: | |
| COSIGN_YES: true |